|
| 1 | +const crypto = require('node:crypto'); |
| 2 | +const { providerRevocationConfig } = require('./passport'); |
| 3 | + |
| 4 | +function generateOAuth1Header(method, url, consumerKey, consumerSecret, token, tokenSecret) { |
| 5 | + const nonce = crypto.randomBytes(16).toString('hex'); |
| 6 | + const timestamp = Math.floor(Date.now() / 1000).toString(); |
| 7 | + const params = { |
| 8 | + oauth_consumer_key: consumerKey, |
| 9 | + oauth_nonce: nonce, |
| 10 | + oauth_signature_method: 'HMAC-SHA1', |
| 11 | + oauth_timestamp: timestamp, |
| 12 | + oauth_token: token, |
| 13 | + oauth_version: '1.0', |
| 14 | + }; |
| 15 | + const paramStr = Object.keys(params) |
| 16 | + .sort() |
| 17 | + .map((k) => `${encodeURIComponent(k)}=${encodeURIComponent(params[k])}`) |
| 18 | + .join('&'); |
| 19 | + const baseStr = `${method.toUpperCase()}&${encodeURIComponent(url)}&${encodeURIComponent(paramStr)}`; |
| 20 | + const signingKey = `${encodeURIComponent(consumerSecret)}&${encodeURIComponent(tokenSecret || '')}`; |
| 21 | + const signature = crypto.createHmac('sha1', signingKey).update(baseStr).digest('base64'); |
| 22 | + params.oauth_signature = signature; |
| 23 | + return `OAuth ${Object.keys(params) |
| 24 | + .sort() |
| 25 | + .map((k) => `${encodeURIComponent(k)}="${encodeURIComponent(params[k])}"`) |
| 26 | + .join(', ')}`; |
| 27 | +} |
| 28 | + |
| 29 | +const REQUIRED_FIELDS = { |
| 30 | + basic: ['clientId', 'clientSecret'], |
| 31 | + body: ['clientId', 'clientSecret'], |
| 32 | + json_body: ['clientId', 'clientSecret'], |
| 33 | + trakt: ['clientId', 'clientSecret'], |
| 34 | + client_id_only: ['clientId'], |
| 35 | + github: ['clientId', 'clientSecret'], |
| 36 | + oauth1: ['consumerKey', 'consumerSecret'], |
| 37 | + token_only: [], |
| 38 | + facebook: [], |
| 39 | +}; |
| 40 | + |
| 41 | +const REVOKE_TIMEOUT_MS = 8000; |
| 42 | + |
| 43 | +async function revokeToken(revokeURL, token, tokenTypeHint, config, tokenSecret) { |
| 44 | + let timeout; |
| 45 | + try { |
| 46 | + const required = REQUIRED_FIELDS[config.authMethod]; |
| 47 | + if (required) { |
| 48 | + const missing = required.filter((f) => !config[f]); |
| 49 | + if (missing.length > 0) { |
| 50 | + console.warn(`Token revocation: skipping ${config.authMethod} — missing config: ${missing.join(', ')}`); |
| 51 | + return false; |
| 52 | + } |
| 53 | + } |
| 54 | + const controller = new AbortController(); |
| 55 | + timeout = setTimeout(() => controller.abort(), REVOKE_TIMEOUT_MS); |
| 56 | + const headers = {}; |
| 57 | + let body; |
| 58 | + let method = 'POST'; |
| 59 | + let finalURL = revokeURL; |
| 60 | + switch (config.authMethod) { |
| 61 | + case 'basic': { |
| 62 | + const credentials = Buffer.from(`${config.clientId}:${config.clientSecret}`).toString('base64'); |
| 63 | + headers.Authorization = `Basic ${credentials}`; |
| 64 | + headers['Content-Type'] = 'application/x-www-form-urlencoded'; |
| 65 | + body = new URLSearchParams({ token, token_type_hint: tokenTypeHint }); |
| 66 | + break; |
| 67 | + } |
| 68 | + case 'body': { |
| 69 | + headers['Content-Type'] = 'application/x-www-form-urlencoded'; |
| 70 | + body = new URLSearchParams({ token, token_type_hint: tokenTypeHint, client_id: config.clientId, client_secret: config.clientSecret }); |
| 71 | + break; |
| 72 | + } |
| 73 | + case 'token_only': { |
| 74 | + headers['Content-Type'] = 'application/x-www-form-urlencoded'; |
| 75 | + body = new URLSearchParams({ token }); |
| 76 | + break; |
| 77 | + } |
| 78 | + case 'client_id_only': { |
| 79 | + headers['Content-Type'] = 'application/x-www-form-urlencoded'; |
| 80 | + body = new URLSearchParams({ token, client_id: config.clientId }); |
| 81 | + break; |
| 82 | + } |
| 83 | + case 'json_body': { |
| 84 | + headers['Content-Type'] = 'application/json'; |
| 85 | + body = JSON.stringify({ token, client_id: config.clientId, client_secret: config.clientSecret }); |
| 86 | + break; |
| 87 | + } |
| 88 | + case 'trakt': { |
| 89 | + headers['Content-Type'] = 'application/json'; |
| 90 | + headers['trakt-api-key'] = config.clientId; |
| 91 | + headers['trakt-api-version'] = '2'; |
| 92 | + body = JSON.stringify({ token, client_id: config.clientId, client_secret: config.clientSecret }); |
| 93 | + break; |
| 94 | + } |
| 95 | + case 'facebook': { |
| 96 | + method = 'DELETE'; |
| 97 | + finalURL = `${revokeURL}?access_token=${encodeURIComponent(token)}`; |
| 98 | + break; |
| 99 | + } |
| 100 | + case 'github': { |
| 101 | + method = 'DELETE'; |
| 102 | + const creds = Buffer.from(`${config.clientId}:${config.clientSecret}`).toString('base64'); |
| 103 | + headers.Authorization = `Basic ${creds}`; |
| 104 | + headers.Accept = 'application/vnd.github+json'; |
| 105 | + headers['X-GitHub-Api-Version'] = '2022-11-28'; |
| 106 | + headers['Content-Type'] = 'application/json'; |
| 107 | + body = JSON.stringify({ access_token: token }); |
| 108 | + break; |
| 109 | + } |
| 110 | + case 'oauth1': { |
| 111 | + headers.Authorization = generateOAuth1Header('POST', revokeURL, config.consumerKey, config.consumerSecret, token, tokenSecret); |
| 112 | + break; |
| 113 | + } |
| 114 | + default: |
| 115 | + console.warn(`Token revocation: unknown authMethod '${config.authMethod}'`); |
| 116 | + return false; |
| 117 | + } |
| 118 | + const response = await fetch(finalURL, { method, headers, body, signal: controller.signal }); |
| 119 | + if (response.ok) return true; |
| 120 | + console.warn(`Token revocation: ${revokeURL} responded with HTTP ${response.status}`); |
| 121 | + return false; |
| 122 | + } catch (err) { |
| 123 | + console.warn(`Token revocation: request to ${revokeURL} failed — ${err.message}`); |
| 124 | + return false; |
| 125 | + } finally { |
| 126 | + clearTimeout(timeout); |
| 127 | + } |
| 128 | +} |
| 129 | + |
| 130 | +async function revokeProviderTokens(providerName, tokenData) { |
| 131 | + const config = providerRevocationConfig[providerName]; |
| 132 | + if (!config || !tokenData) return; |
| 133 | + const tasks = []; |
| 134 | + if (tokenData.refreshToken) { |
| 135 | + tasks.push(revokeToken(config.revokeURL, tokenData.refreshToken, 'refresh_token', config, tokenData.tokenSecret)); |
| 136 | + } |
| 137 | + if (tokenData.accessToken) { |
| 138 | + tasks.push(revokeToken(config.revokeURL, tokenData.accessToken, 'access_token', config, tokenData.tokenSecret)); |
| 139 | + } |
| 140 | + await Promise.allSettled(tasks); |
| 141 | +} |
| 142 | + |
| 143 | +async function revokeAllProviderTokens(tokens) { |
| 144 | + if (!tokens || tokens.length === 0) return; |
| 145 | + const tasks = tokens.filter((t) => providerRevocationConfig[t.kind]).map((t) => revokeProviderTokens(t.kind, t)); |
| 146 | + await Promise.allSettled(tasks); |
| 147 | +} |
| 148 | + |
| 149 | +module.exports = { revokeProviderTokens, revokeAllProviderTokens }; |
0 commit comments